import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns


df = pd.read_csv("./irius_threats_microservice.csv")

df.head()

import pprint as pp
threats = df["Threat"]
threats_unique = df["Threat"].unique()

components = df["Component"].unique()

critical = df[df["Inherent Risk"] == "Critical"]
high = df[df["Inherent Risk"] == "High"]


# print(components.tolist())
print("Components defined:",len(components))

# print(threats.tolist())
print("Threats found:",len(threats))

print("High risks:",len(high))
print("Critical risks:",len(critical))

Components defined: 18
Threats found: 128
High risks: 61
Critical risks: 67

threats_gpt = [
    'Authentication Bypass', 'Insufficient Logging', 'Unauthorized Data Access', 'Authentication Bypass',
    'Data Leakage', 'App Data Manipulation', 'Weak Security Config', 'Cloud Vulnerability', 'Excessive Allocation',
    'Image Tampering', 'Code Injection', 'Scalability Attack', 'Container Access', 'Insufficient Logging',
    'Network Compromise', 'SQL Injection', 'Unauthorized Data Access', 'Authentication Bypass', 'Data Leakage',
    'App Data Manipulation', 'Weak Security Config', 'Cloud Vulnerability', 'Excessive Allocation', 'Image Tampering',
    'Code Injection', 'Scalability Attack', 'Container Access', 'Insufficient Logging', 'Network Compromise',
    'SQL Injection', 'Cross-Site Scripting', 'Security Misconfiguration', 'Third-Party Access', 'Client-Side Secret',
    'Deprecated Technology', 'Cross-Site Scripting', 'Man-in-the-Middle Attack', 'Privilege Abuse', 'ClickJacking',
    'Weak Security Config', 'Cloud Vulnerability', 'Excessive Allocation', 'Image Tampering', 'Code Injection',
    'Scalability Attack', 'Container Access', 'Insufficient Logging', 'Network Compromise', 'Unauthorized Data Access',
    'Authentication Bypass', 'Data Leakage', 'App Data Manipulation', 'Weak Security Config', 'Cloud Vulnerability',
    'Excessive Allocation', 'Image Tampering', 'Code Injection', 'Scalability Attack', 'Container Access',
    'Insufficient Logging', 'Network Compromise', 'SQL Injection', 'Malicious Push Notifications', 'Man-in-the-Middle Attack',
    'SQL Injection', 'Environment Control', 'Account Configuration Flaw', 'Denial of Service', 'Data Deletion',
    'Command Injection', 'Security Misconfiguration', 'Behavior Modification', 'Unnecessary Privileges',
    'Improper ACL Configuration', 'WebView Data Access', 'Error Handling Flaw', 'Buffer Overflow', 'Cross-Site Scripting',
    'Security Misconfiguration', 'Third-Party Access', 'Client-Side Secret', 'Deprecated Technology', 'Cross-Site Scripting',
    'Man-in-the-Middle Attack', 'Privilege Abuse', 'ClickJacking', 'Unauthorized Data Access', 'Authentication Bypass',
    'Data Leakage', 'App Data Manipulation', 'Weak Security Config', 'Cloud Vulnerability', 'Excessive Allocation',
    'Image Tampering', 'Code Injection', 'Scalability Attack', 'Container Access', 'Insufficient Logging',
    'Network Compromise', 'SQL Injection', 'Unauthorized Data Access', 'Authentication Bypass', 'Data Leakage',
    'App Data Manipulation', 'Weak Security Config', 'Cloud Vulnerability', 'Excessive Allocation', 'Image Tampering',
    'Code Injection', 'Scalability Attack', 'Container Access', 'Insufficient Logging', 'Network Compromise', 'SQL Injection',
    'Weak Security Config', 'Cloud Vulnerability', 'Excessive Allocation', 'Image Tampering', 'Code Injection',
    'Scalability Attack', 'Container Access', 'Insufficient Logging', 'Network Compromise', 'Cross-Site Scripting',
    'Security Misconfiguration', 'Client-Side Secret', 'Deprecated Technology', 'Man-in-the-Middle Attack'
]

threat_mapping = dict(zip(df["Threat"].unique(), threats_gpt))
df['Threat abbv'] = threats_gpt
# df['Threat'] = df['Threat'].map(threat_mapping)

# df.to_csv("output_to_check.csv",index=True)

threats_to_stride = {
    'Authentication Bypass': 'Spoofing',
    'Exploitation of insufficient logging and monitoring': 'Repudiation',
    'Attackers gain access to unauthorised data by exploiting vulnerabilities in the service': 'Information Disclosure',
    'Data leakage or disclosure to unauthorized parties': 'Information Disclosure',
    'Attackers who compromise the application or application server could directly access and modify the data store': 'Tampering',
    'Sensitive data is exposed through weak security configurations': 'Information Disclosure',
    'Attackers use known cloud vulnerabilities to access unauthorized data': 'Information Disclosure',
    'Excessive Allocation': 'Denial of Service',
    'Attackers compromise images by modifying their content': 'Tampering',
    'Attackers gain access to the sensitive data through injecting code in the repositories': 'Information Disclosure',
    'Availability is compromised through attacks against scalability configuration': 'Denial of Service',
    'Sensitive data is compromised by unauthorized access to container volumes': 'Information Disclosure',
    'Sensitive data is compromised through network access': 'Information Disclosure',
    'Attackers gain unauthorised access to data and/or systems through SQL Injection attacks': 'Elevation of Privilege',
    'An adversary embeds malicious scripts in content that will be served to web browsers': 'Elevation of Privilege',
    'Application contains security vulnerabilities not identified during the development process': 'Information Disclosure',
    'Attackers gain unauthorised access to data by compromising third party web resources': 'Information Disclosure',
    'Attackers gain unauthorised access to data or services by accessing a client side secret': 'Information Disclosure',
    'Attackers gain unauthorised access to the application by the use of deprecated client-side technologies': 'Elevation of Privilege',
    'Attackers could gain access to sensitive data through a man in the middle attack': 'Information Disclosure',
    'Privilege Abuse': 'Elevation of Privilege',
    'Attackers cause users to perform arbitrary clicks on the site through ClickJacking attacks': 'Elevation of Privilege',
    'An attacker could send malicious push notifications, leading to unauthorized actions, data breaches, or phishing attacks': 'Information Disclosure',
    'Attackers gain unauthorized access to the control of the environment': 'Elevation of Privilege',
    'Attackers gain unauthorized access to the user account due to the lack of configuration of the account': 'Elevation of Privilege',
    'Attackers perform a Denial of Service (DoS)': 'Denial of Service',
    'Data is intentionally or accidentally deleted': 'Tampering',
    'An attacker attempts to invoke all common switches and options to discover weaknesses': 'Information Disclosure',
    'Attacker gains access to sensitive data by modifying the application\'s expected behavior': 'Tampering',
    'Users lose trust in the application because it requests unnecessary privileges': 'Elevation of Privilege',
    'Accessing Functionality Not Properly Constrained by ACLs': 'Elevation of Privilege',
    'Attackers gain access to the data through the WebView functionality': 'Information Disclosure',
    'Attackers gain unauthorised access to the application through an error handling flaw': 'Elevation of Privilege',
    'Attackers gain unauthorised access to the application through buffer overflow flaws': 'Elevation of Privilege'
}

df['STRIDE Category'] = df['Threat'].map(threats_to_stride)

df.head()

df_filtered = df[~df['Component'].isin(['Mobile Device Client', 'Web Client'])]
print(len(df_filtered))

df = df_filtered

115

threats = df["Threat"]
threats_unique = df["Threat"].unique()

components = df["Component"].unique()

critical = df[df["Inherent Risk"] == "Critical"]
high = df[df["Inherent Risk"] == "High"]


# print(components.tolist())
print("Components defined:",len(components))

# print(threats.tolist())
print("Threats found:",len(threats))

print("High risks:",len(high))
print("Critical risks:",len(critical))

Components defined: 16
Threats found: 115
High risks: 59
Critical risks: 56

useful = df[["Component","Use Case","Threat","Threat abbv","Inherent Risk","STRIDE Category"]]
useful.head()

grouped_df = df.groupby(['Component', 'Inherent Risk']).size().unstack(fill_value=0)

grouped_df.plot(kind='bar', stacked=True, figsize=(12, 8))
plt.title('Ilość wykrytych zagrożeń na komponent architektury')
plt.xlabel('Komponent')
plt.ylabel('Ilość wykrytych zagrożeń')
plt.legend(title='Inherent Risk')
plt.show()

grouped_df["Threat Sum"] = grouped_df["Critical"] + grouped_df["High"]
by_threat_sum = grouped_df.sort_values(by="Threat Sum")
print(by_threat_sum)

Inherent Risk         Critical  High  Threat Sum
Component                                       
API gateway                  0     2           2
Catalog DB                   1     3           4
Delivery DB                  1     3           4
Login DB                     1     3           4
Order DB                     1     3           4
Payment DB                   1     3           4
Message Broker               1     6           7
Desktop Frontend             4     5           9
E-mail Notifications         6     3           9
Mobile Frontend              4     5           9
SMS Notifications            6     3           9
Catalog Service              6     4          10
Delivery Service             6     4          10
Login Service                6     4          10
Order Service                6     4          10
Payment Service              6     4          10

heatmap_data = df.groupby(['Threat abbv', 'Component']).size().unstack(fill_value=0)

# Plot the heatmap
plt.figure(figsize=(20, 13))
sns.heatmap(heatmap_data, annot=True, fmt="d",linewidths=1, cmap="crest")
plt.title('Występowanie konkretnych zagrożeń w komponentach')
plt.xlabel('Komponent')
plt.ylabel('Zagrożenie')
plt.xticks(rotation=45,ha="right")
plt.show()

component_category_heatmap = df.groupby(['STRIDE Category','Component']).size().unstack(fill_value=0)
plt.figure(figsize=(15, 4))
sns.heatmap(component_category_heatmap, annot=True,linewidth=1,cmap="crest")
plt.title('Występowanie zagrożeń kategorii STRIDE w komponentach')
plt.xlabel('Komponent')
plt.ylabel('Zagrożenie')
plt.xticks(rotation=45,ha="right")
plt.show()


# # Count occurrences of each combination of STRIDE Category and Component
# threat_counts = df.groupby(['STRIDE Category', 'Component']).size().reset_index(name='Counts')

# # Set seaborn style
# sns.set(style="whitegrid")

# # Create the bar chart
# plt.figure(figsize=(12, 8))
# bar_plot = sns.barplot(x='Counts', y='Component', hue='STRIDE Category', data=threat_counts, palette='pastel')

# # Add title and labels
# plt.title('Threat Counts by STRIDE Category and Component')
# plt.xlabel('Counts')
# plt.ylabel('Component')

# # Display the plot
# plt.show()

import plotly.graph_objects as go

nodes = list(df['Component'].unique()) + list(df['STRIDE Category'].unique()) + list(df['Threat abbv'].unique())

# Define links
links = []
for i, row in df.iterrows():
    links.append({
        'source': row['Component'],
        'target': row['STRIDE Category'],
        'value': 1
    })
    links.append({
        'source': row['STRIDE Category'],
        'target': row['Threat abbv'],
        'value': 1
    })

# Create Sankey diagram
fig = go.Figure(data=[go.Sankey(
    node=dict(
        pad=15,
        thickness=20,
        line=dict(color="black", width=0.5),
        label=nodes,
        color=['blue']*len(df['Component'].unique()) + ['green']*len(df['STRIDE Category'].unique()) + ['red']*len(df['Threat abbv'].unique())
    ),
    link=dict(
        source=[nodes.index(link['source']) for link in links],
        target=[nodes.index(link['target']) for link in links],
        value=[link['value'] for link in links],
    )
)])

# Update layout
fig.update_layout(title_text="Relationship Between Threats, STRIDE Categories, and Components", height=1200)

# Show plot
fig.show()

df[['STRIDE Category','Component']]

stride_counts = df['STRIDE Category'].value_counts()

# Set seaborn style
sns.set(style="whitegrid")

# Create the pie chart using matplotlib
plt.figure(figsize=(8, 8))
colors = sns.color_palette('pastel')[0:len(stride_counts)]
plt.pie(stride_counts, labels=stride_counts.index, colors=colors, autopct='%1.1f%%', startangle=140)

plt.title('Distribution of STRIDE Categories')
plt.axis('equal')  # Equal aspect ratio ensures the pie chart is circular.

# Show the plot
plt.show()

# # Define a unique color for each threat abbreviation using a more distinct palette
# unique_threats = df['Threat abbv'].unique()
# palette = sns.color_palette('tab20', len(unique_threats))
# color_mapping = dict(zip(unique_threats, palette))

# # Plotting the data
# plt.figure(figsize=(14, 10))
# chart = sns.countplot(data=df, y='STRIDE Category', hue='Threat abbv', palette=color_mapping, dodge=False)
# chart.set_title('STRIDE Categories and Corresponding Threat Descriptions (Abbreviated)')
# chart.set_xlabel('Count')
# chart.set_ylabel('STRIDE Category')

# # Adjust the legend
# plt.legend(title='Threat Abbreviation', bbox_to_anchor=(1.05, 1), loc='upper left')

# plt.tight_layout()
# plt.show()

component_category_counts = df.groupby(['Component','STRIDE Category']).size().reset_index(name='Count')

# Plotting the data
plt.figure(figsize=(20, 8))
sns.barplot(x='Component', y='Count', hue='STRIDE Category', data=component_category_counts, palette='viridis')
plt.title('Component/STRIDE Category')
plt.xlabel('Component Name')
plt.ylabel('STRIDE Category')
plt.xticks(rotation=45)
plt.legend(title='STRIDE Category')
plt.tight_layout()
plt.show()

usecase_threat_heatmap = df.groupby(['Use Case','Threat abbv']).size().unstack(fill_value=0)
plt.figure(figsize=(20,7))
sns.heatmap(usecase_threat_heatmap, annot=True,linewidth=1,cmap="crest")
plt.title('Use Case/Threats')
plt.xlabel('Use Case')
plt.ylabel('Threat')
plt.xticks(rotation=45,ha="right")
plt.show()

	Component	Use Case	Source	Threat	Risk response	Inherent Risk	Current Risk	Countermeasure Progress	Weakness Tests	Countermeasure Tests	Projected Risk	Owner
0	API gateway	Authentication and Authorization	Created by rules engine	Authentication Bypass	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond
1	API gateway	Logging and Monitoring	Created by rules engine	Exploitation of insufficient logging and monit...	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond
2	Catalog DB	Access service	Created by rules engine	Attackers gain access to unauthorised data by ...	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	Critical	Critical	0%	Not tested	Not tested	Critical	Tomasz Skrond
3	Catalog DB	Access service	Created by rules engine	Authentication Bypass	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond
4	Catalog DB	Access service	Created by rules engine	Data leakage or disclosure to unauthorized par...	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond

	Component	Use Case	Source	Threat	Risk response	Inherent Risk	Current Risk	Countermeasure Progress	Weakness Tests	Countermeasure Tests	Projected Risk	Owner	Threat abbv	STRIDE Category
0	API gateway	Authentication and Authorization	Created by rules engine	Authentication Bypass	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond	Authentication Bypass	Spoofing
1	API gateway	Logging and Monitoring	Created by rules engine	Exploitation of insufficient logging and monit...	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond	Insufficient Logging	Repudiation
2	Catalog DB	Access service	Created by rules engine	Attackers gain access to unauthorised data by ...	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	Critical	Critical	0%	Not tested	Not tested	Critical	Tomasz Skrond	Unauthorized Data Access	Information Disclosure
3	Catalog DB	Access service	Created by rules engine	Authentication Bypass	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond	Authentication Bypass	Spoofing
4	Catalog DB	Access service	Created by rules engine	Data leakage or disclosure to unauthorized par...	Planned Mitigation: 0%. Mitigated: 0%. Unmitig...	High	High	0%	Not tested	Not tested	High	Tomasz Skrond	Data Leakage	Information Disclosure

Data adjustment + enrichment¶

Print All Threats¶

Podsumowanie 1¶

Add threats abbrieviations for cleaner plotting + map each threat to STRIDE nomenclature¶

Deleted irrelevant rows¶

Most useful data¶

Threats + risk per component¶

Podsumowanie 2¶

Threats in components¶

Analiza trafności wykrytych zagrożeń¶

STRIDE Categories in Components¶

Obserwacje¶

Wnioski¶

Podsumowanie¶

Information Disclosure¶

Elevation of Privilege¶

Denial of Service¶

Tampering¶

Spoofing¶

Wnioski/weryfikacja¶

Threats in use cases¶